Review Results

Comment

The change only bumps google-cloud-cli from 588.0.0 to 590.0.0 in .SRCINFO and updates the corresponding Google-hosted release tarball URLs and checksums for x86_64/aarch64. The sources remain HTTPS on the official dl.google.com domain, there are no new build-time commands, no added scripts, and no packaging/persistence changes visible in this diff. Based on the provided hunk alone, this is a routine version update with low security risk.

@@ -1,6 +1,6 @@
 pkgbase = google-cloud-cli
 	pkgdesc = A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages
-	pkgver = 588.0.0
+	pkgver = 590.0.0
 	pkgrel = 1
 	url = https://cloud.google.com/cli/
 	arch = x86_64

Comment

The change only updates the packaged upstream release version and corresponding SHA256 checksums in .SRCINFO for the x86_64 and aarch64 source tarballs. The download URLs remain HTTPS on dl.google.com, the sources are still pinned to explicit release artifacts, and there are no new scripts, build steps, or privilege-related changes introduced by this diff. No security issues are evident from the metadata update alone.

@@ -17,10 +17,10 @@ pkgbase = google-cloud-cli
 	source = google-cloud-cli.install
 	sha256sums = 6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8
 	sha256sums = 6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6
-	source_x86_64 = google-cloud-cli-588.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_588.0.0.orig_amd64.tar.gz
-	sha256sums_x86_64 = 94e87d9acdaa309edcb9c153f64c2e918b3d79e434a1cba1f7b1fe4df60f6a15
-	source_aarch64 = google-cloud-cli-588.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_588.0.0.orig_aarch64.tar.gz
-	sha256sums_aarch64 = 0da8252d88f9e7d753eeb515bb73f048b680ac6858928a883bce76fcc59b198d
+	source_x86_64 = google-cloud-cli-590.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_590.0.0.orig_amd64.tar.gz
+	sha256sums_x86_64 = 4b556891bbd53cba5e21c90d33172d60c20959e2b0fccda3fd47291ba3be499b
+	source_aarch64 = google-cloud-cli-590.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_590.0.0.orig_aarch64.tar.gz
+	sha256sums_aarch64 = 75014e323e12cb92545ccc42edad075cd6b23a19d75715ae589d28f4f2038427
 
 pkgname = google-cloud-cli
 	install = google-cloud-cli.install

Comment

The change is a routine version bump in PKGBUILD from 588.0.0 to 590.0.0 with updated SHA-256 checksums for the upstream tarballs. No new sources, scripts, patches, install hooks, privilege changes, or build-time network behavior were introduced by this diff. Based on the provided hunk alone, there are no security red flags.

@@ -64,7 +64,7 @@ pkgname=(
 #   'google-cloud-cli-component-kubectl'
 #   'google-cloud-cli-component-gsutil'
 # )
-pkgver=588.0.0
+pkgver=590.0.0
 pkgrel=1
 pkgdesc="A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages"
 url="https://cloud.google.com/cli/"

Comment

The change is a routine version bump for google-cloud-cli from 588.0.0 to 590.0.0 with updated SHA-256 checksums for the architecture-specific upstream tarballs. The source URLs remain HTTPS and point to Google’s official download host, and there are no new build steps, scripts, patches, or packaging behaviors introduced by this diff. No supply-chain or persistence red flags are present in the reviewed hunk.

@@ -86,8 +86,8 @@ source_aarch64=("$pkgbase-$pkgver.orig_aarch64.tar.gz::https://dl.google.com/dl/
 
 sha256sums=('6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8'
             '6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6')
-sha256sums_x86_64=('94e87d9acdaa309edcb9c153f64c2e918b3d79e434a1cba1f7b1fe4df60f6a15')
-sha256sums_aarch64=('0da8252d88f9e7d753eeb515bb73f048b680ac6858928a883bce76fcc59b198d')
+sha256sums_x86_64=('4b556891bbd53cba5e21c90d33172d60c20959e2b0fccda3fd47291ba3be499b')
+sha256sums_aarch64=('75014e323e12cb92545ccc42edad075cd6b23a19d75715ae589d28f4f2038427')
 
 prepare() {
   cd "$_extracted_name"